by Fortinet has released a crack-level vulnerability for FortiOS with a CVSS V3.1 Score of 9.3. The stack-based buffer overflow vulnerability “CWE-122” in FortiOS SSL-VPN could allow an unauthenticated remote attacker to execute arbitrary code or commands via specially crafted requests. Fortinet is aware of a situation where this vulnerability is exploited in a hazardous environment. For information on how to check for the presence of consensus indicators, please visit the link below and contact customer support for assistance.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Critical-vulnerability-Protect-against-heap-based/ta-p/239420
Affected Systems
The following FortiOS versions are affected;
- FortiOS version 7.2.0-7.2.2
- FortiOS version 7.0.0-7.0.8
- FortiOS version 6.4.0 – 6.4.10
- FortiOS version 6.2.0 – 6.2.11
- FortiOS version 6.0.0 – 6.0.15
- FortiOS version 5.6.0 – 5.6.14
- FortiOS version 5.4.0 – 5.4.13
- FortiOS version 5.2.0 – 5.2.15
- FortiOS version 5.0.0 – 5.0.14
- FortiOS-6K7K version 7.0.0 – 7.0.7
- FortiOS-6K7K version 6.4.0 – 6.4.9
- FortiOS-6K7K version 6.2.0 – 6.2.11
- FortiOS-6K7K version 6.0.0 – 6.0.14
- FortiProxy version 7.2.0 – 7.2.1
- FortiProxy version 7.0.0 – 7.0.7
- FortiProxy version 2.0.0 – 2.0.11
- FortiProxy version 1.2.0 – 1.2.13
- FortiProxy version 1.1.0 – 1.1.6
- FortiProxy version 1.0.0 – 1.0.7
Solution and CVE/CWE
CVE/CWE: CVE-2022-42475
The following actions are recommended;
- Upgrade to FortiOS version 7.2.3 or higher
- Upgrade to FortiOS version 7.0.9 or higher
- Upgrade to FortiOS version 6.4.11 or higher
- Upgrade to FortiOS version 6.2.12 or higher
- Upgrade to FortiOS version 6.0.16 or higher
- Upgrade to FortiOS-6K7K version 7.0.8 or higher
- Upgrade to FortiOS-6K7K version 6.4.10 or higher
- Upgrade to FortiOS-6K7K version 6.2.12 or later
- Upgrade to FortiOS-6K7K version 6.0.15 or higher
- Upgrade to FortiProxy version 7.2.2 or higher
- Upgrade to FortiProxy version 7.0.8 or higher
- Upgrade to FortiProxy version 2.0.12 or higher
Workarounds:
- Disable SSL-VPN
Reference:
Note: Those with CVSS 3.1 scores of 7.0-8.9 (out of 10) are considered “high”, and those with 9.0-10.0 are considered “critical”.
